During an active malware outbreak, a SOC analyst confirms that three endpoints in the finance department are communicating with a known command-and-control server. The incident response team wants to stop the spread and preserve the infected systems for later forensic analysis without alerting the attacker prematurely. According to the incident response workflow, which action best represents the current phase the team should execute?